Executive brief
A vulnerability in the Jackson data-processing library could allow an attacker to modify internal data fields that were intended to be protected. This occurs when specific configuration settings allow the library to bypass 'ignore' instructions and write directly to private data. This could lead to unauthorized modification of application data or settings.
Technical details
A vulnerability in POJOPropertiesCollector._renameProperties() in jackson-databind allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be incorrectly retained rather than dropped. When MapperFeature.INFER_PROPERTY_MUTATORS is enabled (the default setting), the library retains the private backing field. During deserialization, BeanDeserializerFactory.addBeanProps() identifies the field and creates a FieldProperty, making the private field writable. An attacker can exploit this by providing the renamed JSON key in a request to write directly to the backing field, bypassing intended access controls. The issue is fixed in versions 2.21.4 and 3.1.4.
Affected products
- FasterXML jackson-databind >= 2.21.0, < 2.21.4; >= 3.0.0, < 3.1.4
Timeline
- 2026-05-06: patched: Fixes committed to 3.1 and 2.21 branches
- 2026-06-23: advisory: NVD publication date
References
- https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a
- https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af
- https://github.com/FasterXML/jackson-databind/pull/5967
- https://github.com/FasterXML/jackson-databind/pull/5968
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55