CVE-2026-54516: FasterXML jackson-databind @JsonIgnore bypass via renamed properties

CVE-2026-54516 · Severity: medium · CVSS 5.3 · Published 2026-06-23

A vulnerability in the Jackson data-processing library could allow an attacker to modify internal data fields that were intended to be protected. This occurs when specific configuration settings allow the library to bypass 'ignore' instructions and write directly to private data. This could lead to unauthorized modification of application data or settings.

Technologies: FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven), tools.jackson.core:jackson-databind (Maven). Vendors: FasterXML, Maven.

Quick answers

Is CVE-2026-54516 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54516 being exploited in the wild.
How severe is CVE-2026-54516?
Medium severity, with a CVSS score of 5.3, published 23 June 2026.
Which products and versions are affected?
FasterXML Jackson Databind >= 2.21.0, < 2.21.4, >= 2.21.0, < 2.21.4; >= 3.0.0, < 3.1.4; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.21.0,fixed=2.21.4; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.4.
Is there a fix for CVE-2026-54516?
Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.4 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54516 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54516?
Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.4 or later
    # set com.fasterxml.jackson.core:jackson-databind to 2.21.4 in your pom.xml or build.gradle
  • tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.4 or later
    # set tools.jackson.core:jackson-databind to 3.1.4 in your pom.xml or build.gradle

Technical details

A vulnerability in POJOPropertiesCollector._renameProperties() in jackson-databind allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be incorrectly retained rather than dropped. When MapperFeature.INFER_PROPERTY_MUTATORS is enabled (the default setting), the library retains the private backing field. During deserialization, BeanDeserializerFactory.addBeanProps() identifies the field and creates a FieldProperty, making the private field writable. An attacker can exploit this by providing the renamed JSON key in a request to write directly to the backing field, bypassing intended access controls. The issue is fixed in versions 2.21.4 and 3.1.4.

Affected products

  • FasterXML jackson-databind >= 2.21.0, < 2.21.4; >= 3.0.0, < 3.1.4

Identifiers

  • CVE-2026-54516
  • GHSA-9fxm-vc8v-hj55

Timeline

  • 2026-05-06: patched: Fixes committed to 3.1 and 2.21 branches
  • 2026-06-23: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.