CVE-2026-54515

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54515
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54515.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54515
Aliases
Downstream
CGA (1915)
CLEANSTART (62)
CLSA (7)
DEBIAN (1)
ECHO (1)
MINI (123)
openSUSE (3)
RHSA (4)
ROOT (1)
SUSE (4)
UBUNTU (1)
Related
openSUSE (3)
SUSE (4)
Published
2026-06-23T20:50:25Z
Modified
2026-10-08T07:13:57Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
Details

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-915"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54515.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.8.0"
                },
                {
                    "fixed": "2.18.9"
                },
                {
                    "introduced": "2.19.0"
                },
                {
                    "fixed": "2.21.5"
                },
                {
                    "introduced": "3.1.0"
                },
                {
                    "fixed": "3.1.4"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/fasterxml/jackson-databind

Affected ranges

Type
GIT
Repo
https://github.com/fasterxml/jackson-databind
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

2.*
2.2.0c
2.6.0-rc3b
jackson-databind-2.*
jackson-databind-2.0.0
jackson-databind-2.0.0-RC1
jackson-databind-2.0.0-RC2
jackson-databind-2.0.0-RC3
jackson-databind-2.0.1
jackson-databind-2.0.2
jackson-databind-2.1.0
jackson-databind-2.1.1
jackson-databind-2.2.0
jackson-databind-2.2.1
jackson-databind-2.2.2
jackson-databind-2.3.0
jackson-databind-2.3.0-rc1
jackson-databind-2.3.1
jackson-databind-2.4.0
jackson-databind-2.4.0-rc1
jackson-databind-2.4.0-rc2
jackson-databind-2.4.0-rc3
jackson-databind-2.4.1
jackson-databind-2.4.1.1
jackson-databind-2.4.1.2
jackson-databind-2.4.1.3
jackson-databind-2.5.0
jackson-databind-2.5.0-rc1
jackson-databind-2.6.0
jackson-databind-2.6.0-rc1
jackson-databind-2.6.0-rc4
jackson-databind-2.6.1
jackson-databind-2.7.0
jackson-databind-2.7.0-rc1
jackson-databind-2.7.0-rc2
jackson-databind-2.7.0-rc3
jackson-databind-2.7.1
jackson-databind-2.7.1-1
jackson-databind-2.8.0
jackson-databind-2.8.1
jackson-databind-2.8.2
jackson-databind-2.9.0
jackson-databind-2.9.0.pr1
jackson-databind-2.9.0.pr2
jackson-databind-2.9.0.pr3
jackson-databind-2.9.0.pr4
jackson-databind-3.*
jackson-databind-3.0.0
jackson-databind-3.0.0-rc1
jackson-databind-3.0.0-rc10
jackson-databind-3.0.0-rc2
jackson-databind-3.0.0-rc3
jackson-databind-3.0.0-rc4
jackson-databind-3.0.0-rc5
jackson-databind-3.0.0-rc6
jackson-databind-3.0.0-rc7
jackson-databind-3.0.0-rc8
jackson-databind-3.0.0-rc9
jackson-databind-3.0.1
jackson-databind-3.1.0
jackson-databind-3.1.0-rc1
jackson-databind-3.1.1
jackson-databind-3.1.2
jackson-databind-3.1.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54515.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "62583708381177563534259892150563942610",
                "237429205559261816817740297917107405300",
                "33768538662840574600343674904985860639",
                "145803945554274867026685793446846441723"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54515-6449d757",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/fasterxml/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa",
        "target": {
            "file": "src/main/java/tools/jackson/databind/deser/bean/BeanDeserializerBase.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "289270255883554323729001357825114710384",
            "length": 2597
        },
        "id": "CVE-2026-54515-6eb96247",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/fasterxml/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa",
        "target": {
            "file": "src/main/java/tools/jackson/databind/deser/bean/BeanDeserializerBase.java",
            "function": "createContextual"
        }
    }
]
vanir_signatures_modified 
"2026-10-08T07:13:57Z"